Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege.

Local Privileged Attackers Can Execute Arbitrary Activities via Bixby Input Validation Flaw

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.

Improper Input Validation in Samsung Message Allows Physical Attackers to Access Sensitive Information

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.

Local Out‑Of‑Bounds Write in MPEG4 Codec

Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local Out-of-Bounds Memory Write in Samsung VC1 Codec

Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local Out‑of‑Bounds Write in Samsung libsmkvextractor.so

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local Privilege Escalation via Improper Permission Handling in CmcCore

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

Improper Export of Android Application Components Enables Local Data Access

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

Improper Authentication Enables Adjacent Attackers to Access Sensitive Data in Samsung Flow

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock.

Out-of-Bounds Memory Access in Samsung Mobile Sound Separation Library

Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory.

Local Access Control Vulnerability in Samsung Internet Allows Sensitive Information Disclosure

Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information.

Local Clipboard Exposure via Path Traversal in Samsung Flow Before 4.9.22.1

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.

Out-of-Bounds Memory Write in Samsung HEIF Decoder Due to Improper Input Validation

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local File Access via Improper Control in Samsung DownloadProvider

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage.

Local Access Control Weakness Exposing Sensitive Information via CocktailBarService

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information.

Out-of-Bounds Write in libcodec2-sec-flacdec.so Allowing Local Memory Corruption

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Access Control Bypass Enables Remote Manipulation of Mobile Device via Samsung Continuity Service

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.

Remote XSS via Improper Input Validation in Samsung Internet Before 30.0.5.24

Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability.

Unauthorized Activity Launch via Incorrect Default Permission in Samsung Flow

Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.